feat: user commands (#75)

* feat: eventstore repository * fix: remove gorm * version * feat: pkg * feat: add some files for project * feat: eventstore without eventstore-lib * rename files * gnueg * fix: key json * fix: add object * fix: change imports * fix: internal models * fix: some imports * fix: global model * feat: add global view functions * fix: add some functions on repo * feat(eventstore): sdk * fix(eventstore): search query * fix(eventstore): rename app to eventstore * delete empty test * remove unused func * merge master * fix(eventstore): tests * fix(models): delete unused struct * fix: some funcitons * feat(eventstore): implemented push events * fix: move project eventstore to project package * fix: change project eventstore funcs * feat(eventstore): overwrite context data * fix: change project eventstore * fix: add project repo to mgmt server * feat(types): SQL-config * fix: commented code * feat(eventstore): options to overwrite editor * feat: auth interceptor and cockroach migrations * fix: migrations * fix: fix filter * fix: not found on getbyid * fix: use global sql config * fix: add sequence * fix: add some tests * fix(eventstore): nullable sequence * fix: add some tests * merge * fix: add some tests * fix(migrations): correct statements for sequence * fix: add some tests * fix: add some tests * fix: changes from mr * fix: changes from mr * fix: add some tests * Update internal/eventstore/models/field.go Co-Authored-By: livio-a <[email protected]> * fix(eventstore): code quality * fix: add types to aggregate/Event-types * fix: try tests * fix(eventstore): rename modifier* to editor* * fix(eventstore): delete editor_org * fix(migrations): remove editor_org field, rename modifier_* to editor_* * fix: query tests * fix: use prepare funcs * fix: go mod * fix: generate files * fix(eventstore): tests * fix(eventstore): rename modifier to editor * fix(migrations): add cluster migration, fix(migrations): fix typo of host in clean clsuter * fix(eventstore): move health * fix(eventstore): AggregateTypeFilter aggregateType as param * code quality * fix: go tests * feat: add member funcs * feat: add member model * feat: add member events * feat: add member repo model * fix: better error func testing * fix: project member funcs * fix: add tests * fix: add tests * feat: implement member requests * fix: merge master * fix: merge master * fix: read existing in project repo * fix: fix tests * feat: add internal cache * feat: add cache mock * fix: return values of cache mock * feat: add project role * fix: add cache config * fix: add role to eventstore * fix: use eventstore sdk * fix: use eventstore sdk * fix: add project role grpc requests * fix: fix getby id * fix: changes for mr * fix: change value to interface * feat: add app event creations * fix: searchmethods * Update internal/project/model/project_member.go Co-Authored-By: Silvan <[email protected]> * fix: use get project func * fix: append events * fix: check if value is string on equal ignore case * fix: add changes test * fix: add go mod * fix: add some tests * fix: return err not nil * fix: return err not nil * fix: add aggregate funcs and tests * fix: add oidc aggregate funcs and tests * fix: add oidc * fix: add some tests * fix: tests * fix: oidc validation * fix: generate client secret * fix: generate client id * fix: test change app * fix: deactivate/reactivate application * fix: change oidc config * fix: change oidc config secret * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * feat: user command side * user command side * profile requests * local config with gopass and more * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <[email protected]> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * changes requested on mr * fix generate codes * fix return if no events * password code * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <[email protected]> * requests of mr * check email Co-authored-by: adlerhurst <[email protected]> Co-authored-by: livio-a <[email protected]>
2026-11-03 12:52:16 +00:00 · 2020-05-11 10:16:27 +02:00
parent 380e4d0643
commit 49d86fdabb
71 changed files with 12791 additions and 2916 deletions
@@ -470,6 +470,11 @@ var ManagementService_AuthMethods = utils_auth.MethodMapping{
 		CheckParam: "",
 	},

+	"/caos.zitadel.management.api.v1.ManagementService/RemoveUserGrant": utils_auth.Option{
+		Permission: "user.grant.delete",
+		CheckParam: "",
+	},
+
 	"/caos.zitadel.management.api.v1.ManagementService/SearchProjectUserGrants": utils_auth.Option{
 		Permission: "project.user.grant.read",
 		CheckParam: "ProjectId",
@@ -3039,6 +3039,44 @@ func request_ManagementService_ReactivateUserGrant_0(ctx context.Context, marsha

 }

+func request_ManagementService_RemoveUserGrant_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq UserGrantID
+	var metadata runtime.ServerMetadata
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["user_id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "user_id")
+	}
+
+	protoReq.UserId, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "user_id", err)
+	}
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.RemoveUserGrant(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
 func request_ManagementService_SearchProjectUserGrants_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq ProjectUserGrantSearchRequest
 	var metadata runtime.ServerMetadata
@@ -5576,6 +5614,26 @@ func RegisterManagementServiceHandlerClient(ctx context.Context, mux *runtime.Se

 	})

+	mux.Handle("DELETE", pattern_ManagementService_RemoveUserGrant_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_RemoveUserGrant_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_RemoveUserGrant_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("POST", pattern_ManagementService_SearchProjectUserGrants_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -6028,6 +6086,8 @@ var (

 	pattern_ManagementService_ReactivateUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"users", "user_id", "grants", "id", "_reactivate"}, ""))

+	pattern_ManagementService_RemoveUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"users", "user_id", "grants", "id"}, ""))
+
 	pattern_ManagementService_SearchProjectUserGrants_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 2, 3, 2, 4}, []string{"projects", "project_id", "users", "grants", "_search"}, ""))

 	pattern_ManagementService_ProjectUserGrantByID_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"projects", "project_id", "users", "user_id", "grants", "id"}, ""))
@@ -6244,6 +6304,8 @@ var (

 	forward_ManagementService_ReactivateUserGrant_0 = runtime.ForwardResponseMessage

+	forward_ManagementService_RemoveUserGrant_0 = runtime.ForwardResponseMessage
+
 	forward_ManagementService_SearchProjectUserGrants_0 = runtime.ForwardResponseMessage

 	forward_ManagementService_ProjectUserGrantByID_0 = runtime.ForwardResponseMessage
@@ -3185,6 +3185,34 @@
          "ManagementService"
        ]
      },
+      "delete": {
+        "operationId": "RemoveUserGrant",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "user_id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      },
      "put": {
        "operationId": "UpdateUserGrant",
        "responses": {
@@ -5477,6 +5505,14 @@
        "sequence": {
          "type": "string",
          "format": "uint64"
+        },
+        "creation_date": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "change_date": {
+          "type": "string",
+          "format": "date-time"
        }
      }
    },
@@ -5496,6 +5532,14 @@
        "sequence": {
          "type": "string",
          "format": "uint64"
+        },
+        "creation_date": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "change_date": {
+          "type": "string",
+          "format": "date-time"
        }
      }
    },
@@ -5564,9 +5608,6 @@
        "user_id": {
          "type": "string"
        },
-        "org_id": {
-          "type": "string"
-        },
        "project_id": {
          "type": "string"
        },
@@ -5705,6 +5746,14 @@
        "sequence": {
          "type": "string",
          "format": "uint64"
+        },
+        "creation_date": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "change_date": {
+          "type": "string",
+          "format": "date-time"
        }
      }
    },
@@ -5714,9 +5763,6 @@
        "id": {
          "type": "string"
        },
-        "state": {
-          "$ref": "#/definitions/v1UserState"
-        },
        "first_name": {
          "type": "string"
        },
@@ -5741,6 +5787,14 @@
        "sequence": {
          "type": "string",
          "format": "uint64"
+        },
+        "creation_date": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "change_date": {
+          "type": "string",
+          "format": "date-time"
        }
      }
    },
@@ -1537,6 +1537,26 @@ func (mr *MockManagementServiceClientMockRecorder) RemoveProjectRole(arg0, arg1
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveProjectRole", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveProjectRole), varargs...)
 }

+// RemoveUserGrant mocks base method
+func (m *MockManagementServiceClient) RemoveUserGrant(arg0 context.Context, arg1 *grpc.UserGrantID, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "RemoveUserGrant", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RemoveUserGrant indicates an expected call of RemoveUserGrant
+func (mr *MockManagementServiceClientMockRecorder) RemoveUserGrant(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveUserGrant", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveUserGrant), varargs...)
+}
+
 // ResendEmailVerificationMail mocks base method
 func (m *MockManagementServiceClient) ResendEmailVerificationMail(arg0 context.Context, arg1 *grpc.UserID, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
 	m.ctrl.T.Helper()
@@ -13,18 +13,22 @@ import (
 var _ ManagementServiceServer = (*Server)(nil)

 type Server struct {
-	port     string
-	project  repository.ProjectRepository
-	verifier *mgmt_auth.TokenVerifier
-	authZ    auth.Config
+	port      string
+	project   repository.ProjectRepository
+	user      repository.UserRepository
+	usergrant repository.UserGrantRepository
+	verifier  *mgmt_auth.TokenVerifier
+	authZ     auth.Config
 }

 func StartServer(conf grpc_util.ServerConfig, authZ auth.Config, repo repository.Repository) *Server {
 	return &Server{
-		port:     conf.Port,
-		project:  repo,
-		authZ:    authZ,
-		verifier: mgmt_auth.Start(),
+		port:      conf.Port,
+		project:   repo,
+		user:      repo,
+		usergrant: repo,
+		authZ:     authZ,
+		verifier:  mgmt_auth.Start(),
 	}
 }

@@ -6,8 +6,12 @@ import (
 	"github.com/golang/protobuf/ptypes/empty"
 )

-func (s *Server) GetUserByID(ctx context.Context, userID *UserID) (*User, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-0oVbs", "Not implemented")
+func (s *Server) GetUserByID(ctx context.Context, id *UserID) (*User, error) {
+	user, err := s.user.UserByID(ctx, id.Id)
+	if err != nil {
+		return nil, err
+	}
+	return userFromModel(user), nil
 }

 func (s *Server) GetUserByEmailGlobal(ctx context.Context, email *UserEmailID) (*User, error) {
@@ -26,76 +30,132 @@ func (s *Server) IsUserUnique(ctx context.Context, request *UniqueUserRequest) (
 	return nil, errors.ThrowUnimplemented(nil, "GRPC-olF56", "Not implemented")
 }

-func (s *Server) CreateUser(ctx context.Context, request *CreateUserRequest) (*User, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-sd4fs", "Not implemented")
+func (s *Server) CreateUser(ctx context.Context, in *CreateUserRequest) (*User, error) {
+	user, err := s.user.CreateUser(ctx, userCreateToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return userFromModel(user), nil
 }

-func (s *Server) DeactivateUser(ctx context.Context, ID *UserID) (*User, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-Vgh64", "Not implemented")
+func (s *Server) DeactivateUser(ctx context.Context, in *UserID) (*User, error) {
+	user, err := s.user.DeactivateUser(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return userFromModel(user), nil
 }

-func (s *Server) ReactivateUser(ctx context.Context, ID *UserID) (*User, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-mCx4f", "Not implemented")
+func (s *Server) ReactivateUser(ctx context.Context, in *UserID) (*User, error) {
+	user, err := s.user.ReactivateUser(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return userFromModel(user), nil
 }

-func (s *Server) LockUser(ctx context.Context, ID *UserID) (*User, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-ds4fd", "Not implemented")
+func (s *Server) LockUser(ctx context.Context, in *UserID) (*User, error) {
+	user, err := s.user.LockUser(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return userFromModel(user), nil
 }

-func (s *Server) UnlockUser(ctx context.Context, ID *UserID) (*User, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-MV7dd", "Not implemented")
+func (s *Server) UnlockUser(ctx context.Context, in *UserID) (*User, error) {
+	user, err := s.user.UnlockUser(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return userFromModel(user), nil
 }

-func (s *Server) DeleteUser(ctx context.Context, ID *UserID) (*empty.Empty, error) {
+func (s *Server) DeleteUser(ctx context.Context, in *UserID) (*empty.Empty, error) {
 	return nil, errors.ThrowUnimplemented(nil, "GRPC-as4fg", "Not implemented")
 }

-func (s *Server) GetUserProfile(ctx context.Context, ID *UserID) (*UserProfile, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-mT67d", "Not implemented")
+func (s *Server) GetUserProfile(ctx context.Context, in *UserID) (*UserProfile, error) {
+	profile, err := s.user.ProfileByID(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return profileFromModel(profile), nil
 }

 func (s *Server) UpdateUserProfile(ctx context.Context, request *UpdateUserProfileRequest) (*UserProfile, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-asje3", "Not implemented")
+	profile, err := s.user.ChangeProfile(ctx, updateProfileToModel(request))
+	if err != nil {
+		return nil, err
+	}
+	return profileFromModel(profile), nil
 }

-func (s *Server) GetUserEmail(ctx context.Context, ID *UserID) (*UserEmail, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-peo9d", "Not implemented")
+func (s *Server) GetUserEmail(ctx context.Context, in *UserID) (*UserEmail, error) {
+	email, err := s.user.EmailByID(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return emailFromModel(email), nil
 }

 func (s *Server) ChangeUserEmail(ctx context.Context, request *UpdateUserEmailRequest) (*UserEmail, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-cloeS", "Not implemented")
+	email, err := s.user.ChangeEmail(ctx, updateEmailToModel(request))
+	if err != nil {
+		return nil, err
+	}
+	return emailFromModel(email), nil
 }

-func (s *Server) ResendEmailVerificationMail(ctx context.Context, ID *UserID) (*empty.Empty, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-dwsP9", "Not implemented")
+func (s *Server) ResendEmailVerificationMail(ctx context.Context, in *UserID) (*empty.Empty, error) {
+	err := s.user.CreateEmailVerificationCode(ctx, in.Id)
+	return &empty.Empty{}, err
 }

-func (s *Server) GetUserPhone(ctx context.Context, ID *UserID) (*UserPhone, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-wlf7f", "Not implemented")
+func (s *Server) GetUserPhone(ctx context.Context, in *UserID) (*UserPhone, error) {
+	phone, err := s.user.PhoneByID(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return phoneFromModel(phone), nil
 }

 func (s *Server) ChangeUserPhone(ctx context.Context, request *UpdateUserPhoneRequest) (*UserPhone, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-pld5g", "Not implemented")
+	phone, err := s.user.ChangePhone(ctx, updatePhoneToModel(request))
+	if err != nil {
+		return nil, err
+	}
+	return phoneFromModel(phone), nil
 }

-func (s *Server) ResendPhoneVerificationCode(ctx context.Context, ID *UserID) (*empty.Empty, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-98hdE", "Not implemented")
+func (s *Server) ResendPhoneVerificationCode(ctx context.Context, in *UserID) (*empty.Empty, error) {
+	err := s.user.CreatePhoneVerificationCode(ctx, in.Id)
+	return &empty.Empty{}, err
 }

-func (s *Server) GetUserAddress(ctx context.Context, ID *UserID) (*UserAddress, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-plt67", "Not implemented")
+func (s *Server) GetUserAddress(ctx context.Context, in *UserID) (*UserAddress, error) {
+	address, err := s.user.AddressByID(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return addressFromModel(address), nil
 }

 func (s *Server) UpdateUserAddress(ctx context.Context, request *UpdateUserAddressRequest) (*UserAddress, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-dleo3", "Not implemented")
+	address, err := s.user.ChangeAddress(ctx, updateAddressToModel(request))
+	if err != nil {
+		return nil, err
+	}
+	return addressFromModel(address), nil
 }

 func (s *Server) SendSetPasswordNotification(ctx context.Context, request *SetPasswordNotificationRequest) (*empty.Empty, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-LSe7s", "Not implemented")
+	err := s.user.RequestSetPassword(ctx, request.Id, notifyTypeToModel(request.Type))
+	return &empty.Empty{}, err
 }

 func (s *Server) SetInitialPassword(ctx context.Context, request *PasswordRequest) (*empty.Empty, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-ldo3s", "Not implemented")
+	_, err := s.user.SetOneTimePassword(ctx, passwordRequestToModel(request))
+	return &empty.Empty{}, err
 }

 func (s *Server) GetUserMfas(ctx context.Context, userID *UserID) (*MultiFactors, error) {
@@ -0,0 +1,258 @@
+package grpc
+
+import (
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/golang/protobuf/ptypes"
+	"golang.org/x/text/language"
+)
+
+func userFromModel(user *usr_model.User) *User {
+	creationDate, err := ptypes.TimestampProto(user.CreationDate)
+	logging.Log("GRPC-8duwe").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(user.ChangeDate)
+	logging.Log("GRPC-ckoe3d").OnError(err).Debug("unable to parse timestamp")
+
+	converted := &User{
+		Id:                user.AggregateID,
+		State:             userStateFromModel(user.State),
+		CreationDate:      creationDate,
+		ChangeDate:        changeDate,
+		Sequence:          user.Sequence,
+		UserName:          user.UserName,
+		FirstName:         user.FirstName,
+		LastName:          user.LastName,
+		DisplayName:       user.DisplayName,
+		NickName:          user.NickName,
+		PreferredLanguage: user.PreferredLanguage.String(),
+		Gender:            genderFromModel(user.Gender),
+	}
+	if user.Email != nil {
+		converted.Email = user.EmailAddress
+		converted.IsEmailVerified = user.IsEmailVerified
+	}
+	if user.Phone != nil {
+		converted.Phone = user.PhoneNumber
+		converted.IsPhoneVerified = user.IsPhoneVerified
+	}
+	if user.Address != nil {
+		converted.Country = user.Country
+		converted.Locality = user.Locality
+		converted.PostalCode = user.PostalCode
+		converted.Region = user.Region
+		converted.StreetAddress = user.StreetAddress
+	}
+	return converted
+}
+
+func userCreateToModel(u *CreateUserRequest) *usr_model.User {
+	preferredLanguage, err := language.Parse(u.PreferredLanguage)
+	logging.Log("GRPC-cK5k2").OnError(err).Debug("language malformed")
+
+	user := &usr_model.User{
+		Profile: &usr_model.Profile{
+			UserName:          u.UserName,
+			FirstName:         u.FirstName,
+			LastName:          u.LastName,
+			NickName:          u.NickName,
+			DisplayName:       u.DisplayName,
+			PreferredLanguage: preferredLanguage,
+			Gender:            genderToModel(u.Gender),
+		},
+		Email: &usr_model.Email{
+			EmailAddress:    u.Email,
+			IsEmailVerified: u.IsEmailVerified,
+		},
+		Address: &usr_model.Address{
+			Country:       u.Country,
+			Locality:      u.Locality,
+			PostalCode:    u.PostalCode,
+			Region:        u.Region,
+			StreetAddress: u.StreetAddress,
+		},
+	}
+	if u.Password != "" {
+		user.Password = &usr_model.Password{SecretString: u.Password}
+	}
+	if u.Phone != "" {
+		user.Phone = &usr_model.Phone{PhoneNumber: u.Phone, IsPhoneVerified: u.IsPhoneVerified}
+	}
+	return user
+}
+
+func passwordRequestToModel(r *PasswordRequest) *usr_model.Password {
+	return &usr_model.Password{
+		ObjectRoot:   models.ObjectRoot{AggregateID: r.Id},
+		SecretString: r.Password,
+	}
+}
+
+func profileFromModel(profile *usr_model.Profile) *UserProfile {
+	creationDate, err := ptypes.TimestampProto(profile.CreationDate)
+	logging.Log("GRPC-dkso3").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(profile.ChangeDate)
+	logging.Log("GRPC-ski8d").OnError(err).Debug("unable to parse timestamp")
+
+	return &UserProfile{
+		Id:                profile.AggregateID,
+		CreationDate:      creationDate,
+		ChangeDate:        changeDate,
+		Sequence:          profile.Sequence,
+		UserName:          profile.UserName,
+		FirstName:         profile.FirstName,
+		LastName:          profile.LastName,
+		DisplayName:       profile.DisplayName,
+		NickName:          profile.NickName,
+		PreferredLanguage: profile.PreferredLanguage.String(),
+		Gender:            genderFromModel(profile.Gender),
+	}
+}
+
+func updateProfileToModel(u *UpdateUserProfileRequest) *usr_model.Profile {
+	preferredLanguage, err := language.Parse(u.PreferredLanguage)
+	logging.Log("GRPC-d8k2s").OnError(err).Debug("language malformed")
+
+	return &usr_model.Profile{
+		ObjectRoot:        models.ObjectRoot{AggregateID: u.Id},
+		FirstName:         u.FirstName,
+		LastName:          u.LastName,
+		NickName:          u.NickName,
+		DisplayName:       u.DisplayName,
+		PreferredLanguage: preferredLanguage,
+		Gender:            genderToModel(u.Gender),
+	}
+}
+
+func emailFromModel(email *usr_model.Email) *UserEmail {
+	creationDate, err := ptypes.TimestampProto(email.CreationDate)
+	logging.Log("GRPC-d9ow2").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(email.ChangeDate)
+	logging.Log("GRPC-s0dkw").OnError(err).Debug("unable to parse timestamp")
+
+	return &UserEmail{
+		Id:              email.AggregateID,
+		CreationDate:    creationDate,
+		ChangeDate:      changeDate,
+		Sequence:        email.Sequence,
+		Email:           email.EmailAddress,
+		IsEmailVerified: email.IsEmailVerified,
+	}
+}
+
+func updateEmailToModel(e *UpdateUserEmailRequest) *usr_model.Email {
+	return &usr_model.Email{
+		ObjectRoot:      models.ObjectRoot{AggregateID: e.Id},
+		EmailAddress:    e.Email,
+		IsEmailVerified: e.IsEmailVerified,
+	}
+}
+
+func phoneFromModel(phone *usr_model.Phone) *UserPhone {
+	creationDate, err := ptypes.TimestampProto(phone.CreationDate)
+	logging.Log("GRPC-ps9ws").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(phone.ChangeDate)
+	logging.Log("GRPC-09ewq").OnError(err).Debug("unable to parse timestamp")
+
+	return &UserPhone{
+		Id:              phone.AggregateID,
+		CreationDate:    creationDate,
+		ChangeDate:      changeDate,
+		Sequence:        phone.Sequence,
+		Phone:           phone.PhoneNumber,
+		IsPhoneVerified: phone.IsPhoneVerified,
+	}
+}
+
+func updatePhoneToModel(e *UpdateUserPhoneRequest) *usr_model.Phone {
+	return &usr_model.Phone{
+		ObjectRoot:      models.ObjectRoot{AggregateID: e.Id},
+		PhoneNumber:     e.Phone,
+		IsPhoneVerified: e.IsPhoneVerified,
+	}
+}
+
+func addressFromModel(address *usr_model.Address) *UserAddress {
+	creationDate, err := ptypes.TimestampProto(address.CreationDate)
+	logging.Log("GRPC-ud8w7").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(address.ChangeDate)
+	logging.Log("GRPC-si9ws").OnError(err).Debug("unable to parse timestamp")
+
+	return &UserAddress{
+		Id:            address.AggregateID,
+		CreationDate:  creationDate,
+		ChangeDate:    changeDate,
+		Sequence:      address.Sequence,
+		Country:       address.Country,
+		StreetAddress: address.StreetAddress,
+		Region:        address.Region,
+		PostalCode:    address.PostalCode,
+		Locality:      address.Locality,
+	}
+}
+
+func updateAddressToModel(address *UpdateUserAddressRequest) *usr_model.Address {
+	return &usr_model.Address{
+		ObjectRoot:    models.ObjectRoot{AggregateID: address.Id},
+		Country:       address.Country,
+		StreetAddress: address.StreetAddress,
+		Region:        address.Region,
+		PostalCode:    address.PostalCode,
+		Locality:      address.Locality,
+	}
+}
+
+func notifyTypeToModel(state NotificationType) usr_model.NotificationType {
+	switch state {
+	case NotificationType_NOTIFICATIONTYPE_EMAIL:
+		return usr_model.NOTIFICATIONTYPE_EMAIL
+	case NotificationType_NOTIFICATIONTYPE_SMS:
+		return usr_model.NOTIFICATIONTYPE_SMS
+	default:
+		return usr_model.NOTIFICATIONTYPE_EMAIL
+	}
+}
+
+func userStateFromModel(state usr_model.UserState) UserState {
+	switch state {
+	case usr_model.USERSTATE_ACTIVE:
+		return UserState_USERSTATE_ACTIVE
+	case usr_model.USERSTATE_INACTIVE:
+		return UserState_USERSTATE_INACTIVE
+	case usr_model.USERSTATE_LOCKED:
+		return UserState_USERSTATE_LOCKED
+	default:
+		return UserState_USERSTATE_UNSPECIFIED
+	}
+}
+
+func genderFromModel(gender usr_model.Gender) Gender {
+	switch gender {
+	case usr_model.GENDER_FEMALE:
+		return Gender_GENDER_FEMALE
+	case usr_model.GENDER_MALE:
+		return Gender_GENDER_MALE
+	case usr_model.GENDER_DIVERSE:
+		return Gender_GENDER_DIVERSE
+	default:
+		return Gender_GENDER_UNSPECIFIED
+	}
+}
+
+func genderToModel(gender Gender) usr_model.Gender {
+	switch gender {
+	case Gender_GENDER_FEMALE:
+		return usr_model.GENDER_FEMALE
+	case Gender_GENDER_MALE:
+		return usr_model.GENDER_MALE
+	case Gender_GENDER_DIVERSE:
+		return usr_model.GENDER_DIVERSE
+	default:
+		return usr_model.GENDER_UNDEFINED
+	}
+}
@@ -3,6 +3,7 @@ package grpc
 import (
 	"context"
 	"github.com/caos/zitadel/internal/errors"
+	"github.com/golang/protobuf/ptypes/empty"
 )

 func (s *Server) SearchUserGrants(ctx context.Context, request *UserGrantSearchRequest) (*UserGrantSearchResponse, error) {
@@ -10,20 +11,45 @@ func (s *Server) SearchUserGrants(ctx context.Context, request *UserGrantSearchR
 }

 func (s *Server) UserGrantByID(ctx context.Context, request *UserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-9dksF", "Not implemented")
+	user, err := s.usergrant.UserGrantByID(ctx, request.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }

 func (s *Server) CreateUserGrant(ctx context.Context, in *UserGrantCreate) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-2kdl2", "Not implemented")
+	user, err := s.usergrant.AddUserGrant(ctx, userGrantCreateToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }
 func (s *Server) UpdateUserGrant(ctx context.Context, in *UserGrantUpdate) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-83jsF", "Not implemented")
+	user, err := s.usergrant.ChangeUserGrant(ctx, userGrantUpdateToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }
 func (s *Server) DeactivateUserGrant(ctx context.Context, in *UserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-93dj3", "Not implemented")
+	user, err := s.usergrant.DeactivateUserGrant(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }
 func (s *Server) ReactivateUserGrant(ctx context.Context, in *UserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-2kSfs", "Not implemented")
+	user, err := s.usergrant.ReactivateUserGrant(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
+}
+
+func (s *Server) RemoveUserGrant(ctx context.Context, in *UserGrantID) (*empty.Empty, error) {
+	err := s.usergrant.RemoveUserGrant(ctx, in.Id)
+	return &empty.Empty{}, err
 }

 func (s *Server) SearchProjectUserGrants(ctx context.Context, request *ProjectUserGrantSearchRequest) (*UserGrantSearchResponse, error) {
@@ -31,22 +57,42 @@ func (s *Server) SearchProjectUserGrants(ctx context.Context, request *ProjectUs
 }

 func (s *Server) ProjectUserGrantByID(ctx context.Context, request *ProjectUserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-dk32s", "Not implemented")
+	user, err := s.usergrant.UserGrantByID(ctx, request.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }

 func (s *Server) CreateProjectUserGrant(ctx context.Context, in *UserGrantCreate) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-0or5G", "Not implemented")
+	user, err := s.usergrant.AddUserGrant(ctx, userGrantCreateToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }
 func (s *Server) UpdateProjectUserGrant(ctx context.Context, in *ProjectUserGrantUpdate) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-asl4D", "Not implemented")
+	user, err := s.usergrant.ChangeUserGrant(ctx, projectUserGrantUpdateToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }

 func (s *Server) DeactivateProjectUserGrant(ctx context.Context, in *ProjectUserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-2fG6h", "Not implemented")
+	user, err := s.usergrant.DeactivateUserGrant(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }

 func (s *Server) ReactivateProjectUserGrant(ctx context.Context, in *ProjectUserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-03kSc", "Not implemented")
+	user, err := s.usergrant.ReactivateUserGrant(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }

 func (s *Server) SearchProjectGrantUserGrants(ctx context.Context, request *ProjectGrantUserGrantSearchRequest) (*UserGrantSearchResponse, error) {
@@ -54,20 +100,40 @@ func (s *Server) SearchProjectGrantUserGrants(ctx context.Context, request *Proj
 }

 func (s *Server) ProjectGrantUserGrantByID(ctx context.Context, request *ProjectGrantUserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-9kfSc", "Not implemented")
+	user, err := s.usergrant.UserGrantByID(ctx, request.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }

 func (s *Server) CreateProjectGrantUserGrant(ctx context.Context, in *ProjectGrantUserGrantCreate) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-293md", "Not implemented")
+	user, err := s.usergrant.ChangeUserGrant(ctx, projectGrantUserGrantCreateToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }
 func (s *Server) UpdateProjectGrantUserGrant(ctx context.Context, in *ProjectGrantUserGrantUpdate) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-76fGe", "Not implemented")
+	user, err := s.usergrant.ChangeUserGrant(ctx, projectGrantUserGrantUpdateToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }

 func (s *Server) DeactivateProjectGrantUserGrant(ctx context.Context, in *ProjectGrantUserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-sFsi3", "Not implemented")
+	user, err := s.usergrant.DeactivateUserGrant(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }

 func (s *Server) ReactivateProjectGrantUserGrant(ctx context.Context, in *ProjectGrantUserGrantID) (*UserGrant, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-ckr56", "Not implemented")
+	user, err := s.usergrant.ReactivateUserGrant(ctx, in.Id)
+	if err != nil {
+		return nil, err
+	}
+	return usergrantFromModel(user), nil
 }
@@ -0,0 +1,76 @@
+package grpc
+
+import (
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	grant_model "github.com/caos/zitadel/internal/usergrant/model"
+	"github.com/golang/protobuf/ptypes"
+)
+
+func usergrantFromModel(grant *grant_model.UserGrant) *UserGrant {
+	creationDate, err := ptypes.TimestampProto(grant.CreationDate)
+	logging.Log("GRPC-ki9ds").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(grant.ChangeDate)
+	logging.Log("GRPC-sl9ew").OnError(err).Debug("unable to parse timestamp")
+
+	return &UserGrant{
+		Id:           grant.AggregateID,
+		UserId:       grant.UserID,
+		State:        usergrantStateFromModel(grant.State),
+		CreationDate: creationDate,
+		ChangeDate:   changeDate,
+		Sequence:     grant.Sequence,
+		ProjectId:    grant.ProjectID,
+		RoleKeys:     grant.RoleKeys,
+	}
+}
+
+func userGrantCreateToModel(u *UserGrantCreate) *grant_model.UserGrant {
+	return &grant_model.UserGrant{
+		ObjectRoot: models.ObjectRoot{AggregateID: u.UserId},
+		UserID:     u.UserId,
+		ProjectID:  u.ProjectId,
+		RoleKeys:   u.RoleKeys,
+	}
+}
+
+func userGrantUpdateToModel(u *UserGrantUpdate) *grant_model.UserGrant {
+	return &grant_model.UserGrant{
+		ObjectRoot: models.ObjectRoot{AggregateID: u.Id},
+		RoleKeys:   u.RoleKeys,
+	}
+}
+
+func projectUserGrantUpdateToModel(u *ProjectUserGrantUpdate) *grant_model.UserGrant {
+	return &grant_model.UserGrant{
+		ObjectRoot: models.ObjectRoot{AggregateID: u.Id},
+		RoleKeys:   u.RoleKeys,
+	}
+}
+
+func projectGrantUserGrantCreateToModel(u *ProjectGrantUserGrantCreate) *grant_model.UserGrant {
+	return &grant_model.UserGrant{
+		UserID:    u.UserId,
+		ProjectID: u.ProjectId,
+		RoleKeys:  u.RoleKeys,
+	}
+}
+
+func projectGrantUserGrantUpdateToModel(u *ProjectGrantUserGrantUpdate) *grant_model.UserGrant {
+	return &grant_model.UserGrant{
+		ObjectRoot: models.ObjectRoot{AggregateID: u.Id},
+		RoleKeys:   u.RoleKeys,
+	}
+}
+
+func usergrantStateFromModel(state grant_model.UserGrantState) UserGrantState {
+	switch state {
+	case grant_model.USERGRANTSTATE_ACTIVE:
+		return UserGrantState_USERGRANTSTATE_ACTIVE
+	case grant_model.USERGRANTSTATE_INACTIVE:
+		return UserGrantState_USERGRANTSTATE_INACTIVE
+	default:
+		return UserGrantState_USERGRANTSTATE_UNSPECIFIED
+	}
+}
@@ -994,7 +994,6 @@ service ManagementService {
        };
    }

-
    //USER_GRANT
    rpc SearchUserGrants(UserGrantSearchRequest) returns (UserGrantSearchResponse) {
        option (google.api.http) = {
@@ -1061,6 +1060,16 @@ service ManagementService {
        };
    }

+    rpc RemoveUserGrant(UserGrantID) returns (google.protobuf.Empty) {
+        option (google.api.http) = {
+            delete: "/users/{user_id}/grants/{id}"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "user.grant.delete"
+        };
+    }
+
    //PROJECT_USER_GRANT
    rpc SearchProjectUserGrants(ProjectUserGrantSearchRequest) returns (UserGrantSearchResponse) {
        option (google.api.http) = {
@@ -1362,15 +1371,16 @@ enum SearchMethod {

 message UserProfile {
    string id = 1;
-    UserState state = 2;
-    string first_name = 3;
-    string last_name = 4;
-    string nick_name = 5;
-    string display_name = 6;
-    string preferred_language = 7;
-    Gender gender = 8;
-    string user_name = 9;
-    uint64 sequence = 10;
+    string first_name = 2;
+    string last_name = 3;
+    string nick_name = 4;
+    string display_name = 5;
+    string preferred_language = 6;
+    Gender gender = 7;
+    string user_name = 8;
+    uint64 sequence = 9;
+    google.protobuf.Timestamp creation_date = 10;
+    google.protobuf.Timestamp change_date = 11;
 }

 message UpdateUserProfileRequest {
@@ -1388,6 +1398,8 @@ message UserEmail {
    string email = 2;
    bool is_email_verified = 3;
    uint64 sequence = 4;
+    google.protobuf.Timestamp creation_date = 5;
+    google.protobuf.Timestamp change_date = 6;
 }

 message UpdateUserEmailRequest {
@@ -1401,6 +1413,8 @@ message UserPhone {
    string phone = 2;
    bool is_phone_verified = 3;
    uint64 sequence = 5;
+    google.protobuf.Timestamp creation_date = 6;
+    google.protobuf.Timestamp change_date = 7;
 }

 message UpdateUserPhoneRequest {
@@ -1417,6 +1431,8 @@ message UserAddress {
    string region = 5;
    string street_address = 6;
    uint64 sequence = 7;
+    google.protobuf.Timestamp creation_date = 8;
+    google.protobuf.Timestamp change_date = 9;
 }

 message UpdateUserAddressRequest {
@@ -2089,9 +2105,8 @@ message UserGrant {

 message UserGrantCreate {
    string user_id = 1;
-    string org_id = 2;
-    string project_id = 3;
-    repeated string role_keys = 4;
+    string project_id = 2;
+    repeated string role_keys = 3;
 }

 message UserGrantUpdate {